Identity, Access and Security — Azure AZ-900 Fundamentals practice questions

Which built-in RBAC role grants full access but cannot delegate access to others?

1. Owner
2. Contributor
3. Reader
4. User Access Administrator

Answer: B — Contributor

A) Owner can delegate. B) Correct — Contributor has full management except role assignment. C) Read-only. D) Manages access only.

Microsoft Defender for Cloud primarily provides:

1. Security posture management plus workload protection for cloud resources
2. Authoritative DNS hosting for public and private domain name records
3. Build and release pipelines that compile, test and ship application code
4. Spend tracking and forecasting broken down by subscription and by tag

Answer: A — Security posture management plus workload protection for cloud resources

A) Correct — Defender for Cloud scores posture, recommends hardening and adds workload protection plans. B) That is Azure DNS. C) That is a pipeline product outside the AZ-900 scope. D) That is cost analysis.

Azure RBAC role assignments can be made at which scopes?

1. Any of management group, subscription, resource group or resource
2. Only at the subscription, then inherited by everything beneath it
3. Only at a resource group, and never at any level above or below it
4. Only at the tenant root management group covering the whole directory

Answer: A — Any of management group, subscription, resource group or resource

A) Correct — all four scopes accept assignments and permissions inherit downward from the scope chosen. B) Subscription is one valid scope of several. C) Resource group is likewise only one option. D) The root management group is a scope, not the only one.

Microsoft Purview sensitivity labels are used to:

1. Classify data and apply protection based on its sensitivity
2. Configure virtual network peering and route traffic between subnets
3. Provision virtual machines from images stored in a shared gallery
4. Run analytical SQL queries against tables in a relational database

Answer: A — Classify data and apply protection based on its sensitivity

A) Correct — labels record the sensitivity of content and can enforce encryption and usage restrictions that travel with the data. B) That is virtual network configuration. C) That is compute provisioning. D) That is a database workload, not a governance control.

Passwordless sign-in options in Microsoft Entra ID include:

1. Windows Hello for Business, FIDO2 security keys and the Authenticator app
2. SMS text codes sent to a registered mobile number at every sign-in
3. Emailed magic links that carry a one-time URL to the user's mailbox
4. Password hint questions the user answers instead of typing a password

Answer: A — Windows Hello for Business, FIDO2 security keys and the Authenticator app

A) Correct — those three are the passwordless methods Microsoft supports, each pairing a device with a biometric or PIN. B) A text code still supplements a password and is the weakest factor. C) Emailed links are not a Microsoft passwordless method. D) A hint is still a password mechanism.

Single sign-on PRIMARILY improves:

1. Hardware utilization by packing more workloads onto each host server
2. User experience and security by cutting repeated passwords and reuse
3. Storage throughput by caching frequently read blobs closer to users
4. Network bandwidth by compressing traffic between regions and clients

Answer: B — User experience and security by cutting repeated passwords and reuse

B) Correct — users authenticate once and reach many applications, so fewer credentials are typed and reused. A) That is a virtualization benefit, not an identity one. C) That describes caching or a content delivery network. D) Compression is unrelated to sign-in.

Multifactor authentication strengthens sign-in because it requires:

1. Two or more different factors, such as a password plus a device prompt
2. A longer password that is rotated on a fixed schedule every few months
3. A second password stored separately from the first one in a key vault
4. A network firewall rule that limits sign-in to corporate IP ranges

Answer: A — Two or more different factors, such as a password plus a device prompt

A) Correct — multifactor authentication combines factors of different types, so a stolen password alone is not enough. B) Length and rotation still leave a single factor. C) Two passwords are still the same category of factor. D) An IP restriction is a network control, not a second factor.

What is Microsoft Entra ID (formerly Azure AD)?

1. An Azure VM type
2. A database service
3. Cloud-based identity and access management
4. A storage product

Answer: C — Cloud-based identity and access management

A) Not a VM. B) Not a database. C) Correct — Entra ID is Microsoft's cloud identity platform: SSO, MFA, conditional access, B2B/B2C. Foundation of Azure security. D) Not storage.

Multi-Factor Authentication requires:

1. Two passwords
2. Two or more verification methods from different categories (know, have, are)
3. A complex password only
4. An admin to approve every login

Answer: B — Two or more verification methods from different categories (know, have, are)

A) Two passwords is not MFA — they're the same category. B) Correct — MFA combines factors: something you KNOW (password), HAVE (phone/token), ARE (biometric). C) Password complexity alone is single-factor. D) That's approval workflow, not MFA.

Microsoft Entra External ID is BEST used to:

1. Let partner and customer identities sign in to your apps as guests
2. Replicate on-premises Active Directory objects to domain controllers
3. Assign Azure RBAC roles to resources within a single subscription scope
4. Issue physical access badges to contractors visiting company offices

Answer: A — Let partner and customer identities sign in to your apps as guests

A) Correct — External ID covers identities outside your organisation, letting partners and customers use their own credentials to reach your resources. B) Microsoft Entra Connect and Cloud Sync handle directory synchronisation. C) That is Azure RBAC, an authorisation feature. D) Badges are physical security, not identity management.

Microsoft Sentinel?

Cloud-native SIEM + SOAR. Centralized security event management with AI-driven analysis.

What are external identities in Microsoft Entra, and why use them?

Microsoft Entra External ID lets people outside the organisation — partners, contractors, customers — sign in with their own identity from their home directory or a social account. The external organisation keeps managing that identity and its lifecycle, so you never create or reset a password for a guest.

State the guiding principles of Zero Trust and the layers of defense in depth.

Zero Trust: verify explicitly, use least-privilege access, and assume breach. Defense in depth layers, outermost to innermost: physical security • identity and access • perimeter • network • compute • application • data. Each layer slows an attacker so no single control failure is fatal.

Defense in Depth — number of layers?

7 layers: Physical → Identity → Perimeter → Network → Compute → Application → Data.